Commit 500b717f authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'dmi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging 

Pull dmi updates from Jean Delvare.

* 'dmi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging:
  firmware: dmi: Fortify entry point length checks
parents 8de1037a 13a0ac81

drivers/firmware/dmi_scan.c

+8 −2
Original line number Diff line number Diff line
@@ -567,8 +567,13 @@ static int __init dmi_present(const u8 *buf) 
{

	u32 smbios_ver;



	/*

	 * The size of this structure is 31 bytes, but we also accept value

	 * 30 due to a mistake in SMBIOS specification version 2.1.

	 */

	if (memcmp(buf, "_SM_", 4) == 0 &&

	    buf[5] < 32 && dmi_checksum(buf, buf[5])) {

	    buf[5] >= 30 && buf[5] <= 32 &&

	    dmi_checksum(buf, buf[5])) {

		smbios_ver = get_unaligned_be16(buf + 6);

		smbios_entry_point_size = buf[5];

		memcpy(smbios_entry_point, buf, smbios_entry_point_size);
@@ -629,7 +634,8 @@ static int __init dmi_present(const u8 *buf) 
static int __init dmi_smbios3_present(const u8 *buf)

{

	if (memcmp(buf, "_SM3_", 5) == 0 &&

	    buf[6] < 32 && dmi_checksum(buf, buf[6])) {

	    buf[6] >= 24 && buf[6] <= 32 &&

	    dmi_checksum(buf, buf[6])) {

		dmi_ver = get_unaligned_be24(buf + 7);

		dmi_num = 0;			/* No longer specified */

		dmi_len = get_unaligned_le32(buf + 12);